https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 05:35:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-325633 EUVD-2026-325633 https://cve.radiocsirt.org/vuln/euvd-2026-325633 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46481 <p>OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token can then be reused as Authorization: Bearer &lt;jwt&gt; to access sensitive service APIs with bot-level privileges. This issue has been patched in version 1.12.4.</p> <p>OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token can then be reused as Authorization: Bearer &lt;jwt&gt; to access sensitive service APIs with bot-level privileges. This issue has been patched in version 1.12.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46481 https://cve.radiocsirt.org/vuln/ghsa-9vmh-whc4-7phg <p><strong>Affected:</strong> Maven: org.open-metadata:openmetadata-service</p> <p>**This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production** In OpenMetadata 1.12.1, a non-admin SSO user can trigger a `TEST_CONNECTION` workflow for a Database Service and receive, in the HTTP 201 response of `POST /api/v1/automations/workflows`, both:</p> <p>- The cleartext database password in `request.connection.config.password`. - The ingestion bot JWT in `openMetadataServerConnection.securityConfig.jwtToken`.</p> <p>The leaked ingestion-bot token can then be reused as `Authorization: Bearer &lt;jwt&gt;` to access sensitive service APIs (for example, `GET /api/v1/services/databaseServices/{id}?include=all`) with bot-level privileges.</p> <p>This looks different from GHSA-pqqf-7hxm-rj5r, because it affects the `automations/workflows` TEST_CONNECTION endpoint on OpenMetadata 1.12.1, not the ingestion pipelines endpoints.</p> <p>---</p> <p>Version / Product</p> <p>- Product: OpenMetadata (open source, Apache 2.0) - Version: 1.12.1 - GET /api/v1/system/version → {&#34;version&#34;:&#34;1.12.1&#34;,&#34;revision&#34;:&#34;618a2dc2ec8f70ffcd0378ee14ce92cb4f98f0c5&#34;} - Deployment: OpenMetadata server with SSO via Azure AD (OAuth), Oracle database service, secrets in DB secrets manager (`secretsManagerProvider: &#34;db&#34;`).</p> <p>---</p> <p>Preconditions</p> <p>- Authenticated SSO user with access to the UI. - User can open a Database Service and click “Test connection”. - No server admin role, no shell/DB access.</p> <p>---</p> <p>PoC (short)</p> <p>1) Login as a reg…</p> <p><strong>Affected:</strong> Maven: org.open-metadata:openmetadata-service</p> <p>**This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production** In OpenMetadata 1.12.1, a non-admin SSO user can trigger a `TEST_CONNECTION` workflow for a Database Service and receive, in the HTTP 201 response of `POST /api/v1/automations/workflows`, both:</p> <p>- The cleartext database password in `request.connection.config.password`. - The ingestion bot JWT in `openMetadataServerConnection.securityConfig.jwtToken`.</p> <p>The leaked ingestion-bot token can then be reused as `Authorization: Bearer &lt;jwt&gt;` to access sensitive service APIs (for example, `GET /api/v1/services/databaseServices/{id}?include=all`) with bot-level privileges.</p> <p>This looks different from GHSA-pqqf-7hxm-rj5r, because it affects the `automations/workflows` TEST_CONNECTION endpoint on OpenMetadata 1.12.1, not the ingestion pipelines endpoints.</p> <p>---</p> <p>Version / Product</p> <p>- Product: OpenMetadata (open source, Apache 2.0) - Version: 1.12.1 - GET /api/v1/system/version → {&#34;version&#34;:&#34;1.12.1&#34;,&#34;revision&#34;:&#34;618a2dc2ec8f70ffcd0378ee14ce92cb4f98f0c5&#34;} - Deployment: OpenMetadata server with SSO via Azure AD (OAuth), Oracle database service, secrets in DB secrets manager (`secretsManagerProvider: &#34;db&#34;`).</p> <p>---</p> <p>Preconditions</p> <p>- Authenticated SSO user with access to the UI. - User can open a Database Service and click “Test connection”. - No server admin role, no shell/DB access.</p> <p>---</p> <p>PoC (short)</p> <p>1) Login as a reg…</p> https://cve.radiocsirt.org/vuln/ghsa-9vmh-whc4-7phg